This is a request for allthetropeswiki but I honestly don't see why it shouldn't be default for everyone.
All of these functions (len, pos, rpos, sub, replace, explode) are integrated from the StringFunctions extension, but are only available if an administrator sets $wgPFEnableStringFunctions = true; in LocalSettings.php.
All of these functions operate in O(n) time complexity, making them safe against DoS attacks.
Note we already have Extension:Regex Functions as an option -- these should be cheaper and easier not to screw up.
So, I propose adding this:
'wgPFEnableStringFunctions' => [ 'default' => true, ],